Mutual TLS (mTLS)

Mutual TLS is a variant of the TLS handshake where the server requests a client certificate in addition to presenting its own. After validating the certificate chain and verifying possession of the private key, both endpoints establish an encrypted, mutually authenticated session. It is widely used for machine-to-machine and service-to-service communication in zero-trust architectures, API gateways, service meshes, and VPN replacements. Defences and hygiene include short-lived certificates issued by a private CA, automated rotation, OCSP or CRL checking, and strict identity matching to deny tokens or bearer credentials when the client certificate does not match.